Found a security issue? Report it responsibly to office@aifortis.com.
1. Security by design
Encryption in transit and at rest, tenant isolation and least-privilege access are defaults across the systems we build, not afterthoughts. Security requirements are part of the design from day one.
2. Data protection
We design data flows, consent and retention around the GDPR. Secrets and credentials are kept in encrypted storage or a managed secrets manager, never in plaintext, and access is scoped to those who need it.
3. Access control and operations
Production systems are monitored, patched and load-tested. Administrative access is restricted, logged and auditable, and we follow the principle of least privilege.
4. Hosting and providers
This website and our platform run on established infrastructure providers - Vercel (hosting), Supabase (database), LiveKit (real-time voice), Cloudflare (storage) and Google Workspace (email and calendar) - selected for their security posture and bound by appropriate contractual terms. Demo call recordings are stored encrypted and auto-deleted after 12 months.
5. Responsible disclosure
If you believe you have found a security vulnerability in this website or our products, please email office@aifortis.com with details. We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and we will acknowledge legitimate reports.
6. Engagement-specific security
For client projects, specific security measures, certifications and responsibilities are agreed in the relevant contract and any Data Processing Agreement, tailored to the systems and data involved. ScanSystems deployments keep documents in an encrypted central archive with per-user access control and can run in the cloud, fully on-premise on the client's own infrastructure, or as a hybrid - so document data can stay entirely within the client's systems where required.